A specially crafted web-page can cause a type confusion vulnerability in Microsoft Internet Explorer 8 through to 11. An attacker can cause code to be executed with a stack layout it does not expect, or have code attempt to execute a method of an object using a vftable, when that object does not have a vftable. Successful exploitation can lead to arbitrary code execution.
Microsoft Internet Explorer 8, 9, 10 and 11
In an SVG page, a copy of the
hasFeature method of a
object from a HTML page is created. This copy is used as a method of a new
object and called with one argument. This can cause at least two issues in the
MSHTML!Method_VARIANTBOOLp_BSTR_o0oVARIANT function of MSIE:
o.in the repro to
MSHTML!CBase::is called; this is probably caused by a type confusion bug: the code expects a
VARIANTobject of one type, but is working on an object of a different type.
The repro was tested on x86 systems and does not reproduce this issue on x64 systems. I did not determine if this is because x64 systems are not affected, or because the repro needs to be modified to work on x64 systems.
Exploitation was not attempted. I reversed
only sufficiently to get an idea of the root cause, but not enough to determine
exactly what is going on or how to control the issue for command execution.
isPrototypeOf method of the
DOMImplementation interface as a
function results in type confusion where an object is assumed to implement
IUnknown when in fact it does not. The code attempts to call the
IUnknown through the vftable at offset 0, but since the object has
no vftables, a member property is stored at this offset, which appears to have
a static value
002dc6c0. An attacker that is able to control this value, or
allocate memory and store data at that address, may be able to execute
No attempts were made to further reverse the code and determine the exact root cause. A few attempts were made to control the value at offset 0 of the object in question, as well as get another object in its place with a different value at this location, but both efforts were brief and unsuccessful.